We have invested in the technology that enables you to send us your credit/debit card details, securely, via our Internet site.

Using a credit/debit card has become the simplest way to arrange payment for orders..

When you place an order or update your personal details, the forms are loaded via Secure Sockets Layer (SSL for short). Your web browser is then connected directly to our secure server. You can see the connection is secure by looking at the padlock or key icon at the bottom of your browser. You'll also note the address in the URL bar starts https:// rather than just http://. Our secure server is:

Your browser may also warn you that you are connecting to a secure server, and if so it will also tell you when you are closing the secure connection once you have submitted your order or other personal information. These "warnings" are for your information only.

Our secure server then communicates with your browser using SSL, so that all the personal information you send (including your credit or debit card details, name and address etc.), is encrypted, a process which takes the words and figures you type and converts them into bits of code that are then securely transmitted over the Internet.

Our office machines are behind a firewall and is Sophos anti-virus protected.


All payments on our Web site are processed via SagePay or Paypal, depending on what method you choose. We do not have access to your credit or debit card details.

Transaction security

All transaction information passed between our Web site and SagePay’s systems is encrypted using 256-bit SSL certificates. No cardholder information is ever passed unencrypted and any messages sent to our servers from SagePay and Paypal are signed using MD5 hashing to prevent tampering. You can be completely assured that nothing passed to SagePay’s servers can be examined, used or modified by any third parties attempting to gain access to sensitive information.

Encryption and data storage

Once on SagePay's or the Paypal systems, all sensitive data is secured using the same internationally recognised 256-bit encryption standards used by, among others, the US Government. The encryption keys are held on state-of-the-art, tamper proof systems in the same family as those used to secure VeriSign's Global Root certificate, making them all but impossible to extract. SagePay is extremely secure and they are regularly audited by the banks and banking authorities to ensure that they remain so.

System security

SagePay’s systems are scanned quarterly by Trustwave which are an independent Qualified Security Assessor (QSA) and an Approved Scanning Vendor (ASV) for the payment card brands.

SagePay is also audited annually under the Payment Card Industry Data Security Standards (PCI DSS) and is a fully approved Level 1 payment services provider, which is the highest level of compliance. They are also active members of the PCI Security Standards Council (SSC) that defines card industry global regulation.

View SagePay's PCI DSS certificate

Links to banks

SagePay has multiple private links into the banking network that are completely separate from the Internet and which do not cross any publicly accessible networks. Any cardholder information sent to the banks and any authorisation message coming back is secure and cannot be tampered with.

Internal security

SagePay is controlled by Iris Scanners, which are the latest and most precise biometric security devices available for identification. As used by: chemical plants, airports, police stations, prisons and other facilities where security is paramount. No one can enter or leave the building without a valid security pass.

Staff validation

All employees at SagePay are Criminal Records Bureau (CRB) checked prior to employment and no unauthorized individual has access to or is able to decrypt transaction information or cardholder data. Their systems only allow access by their most senior staff and only in extenuating circumstances (such as investigations of Card Fraud by the Police). All transaction information and customer card information is secure even from their own employees.

Disaster recovery

SagePay operates on twin data centres to ensure optimal system security and up-time and has a full disaster recovery and business continuation policy.

If you have any further questions, please contact us.

Last updated: 24 July 2011

Portions of this policy are © Copyright Sage (UK